Subject: Re: [PATCH v3 1/2] arm64: kaslr: Announce KASLR status on boot

From: Mark Rutland <[email-masked]>
Date: Fri, 8 Nov 2019 16:46:36 +0000

On Fri, Nov 08, 2019 at 04:20:00PM +0000, Mark Brown wrote:
> Currently the KASLR code is silent at boot unless it forces on KPTI in
> which case a message will be printed for that. This can lead to users
> incorrectly believing their system has the feature enabled when it in
> fact does not, and if they notice the problem the lack of any
> diagnostics makes it harder to understand the problem. Add an initcall
> which prints a message showing the status of KASLR during boot to make
> the status clear.
> 
> This is particularly useful in cases where we don't have a seed. It
> seems to be a relatively common error for system integrators and
> administrators to enable KASLR in their configuration but not provide
> the seed at runtime, often due to seed provisioning breaking at some
> later point after it is initially enabled and verified.
> 
> Signed-off-by: Mark Brown <[email-masked]>
> ---
>  arch/arm64/kernel/kaslr.c | 41 ++++++++++++++++++++++++++++++++++++---
>  1 file changed, 38 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
> index 416f537bf614..0039dc50e556 100644
> --- a/arch/arm64/kernel/kaslr.c
> +++ b/arch/arm64/kernel/kaslr.c
> @@ -19,6 +19,14 @@
>  #include <asm/pgtable.h>
>  #include <asm/sections.h>
>  
> +enum kaslr_status {
> +	KASLR_ENABLED,
> +	KASLR_DISABLED_CMDLINE,
> +	KASLR_DISABLED_NO_SEED,
> +	KASLR_DISABLED_FDT_REMAP,
> +};
> +
> +enum kaslr_status __ro_after_init kaslr_status;

This can probably be __initdata since it's only consumed by an __init
call.

Otherwise this looks sound to me; with that:

Acked-by: Mark Rutland <[email-masked]>

Thanks,
Mark.

>  u64 __ro_after_init module_alloc_base;
>  u16 __initdata memstart_offset_seed;
>  
> @@ -91,15 +99,19 @@ u64 __init kaslr_early_init(u64 dt_phys)
>  	 */
>  	early_fixmap_init();
>  	fdt = fixmap_remap_fdt(dt_phys, &size, PAGE_KERNEL);
> -	if (!fdt)
> +	if (!fdt) {
> +		kaslr_status = KASLR_DISABLED_FDT_REMAP;
>  		return 0;
> +	}
>  
>  	/*
>  	 * Retrieve (and wipe) the seed from the FDT
>  	 */
>  	seed = get_kaslr_seed(fdt);
> -	if (!seed)
> +	if (!seed) {
> +		kaslr_status = KASLR_DISABLED_NO_SEED;
>  		return 0;
> +	}
>  
>  	/*
>  	 * Check if 'nokaslr' appears on the command line, and
> @@ -107,8 +119,10 @@ u64 __init kaslr_early_init(u64 dt_phys)
>  	 */
>  	cmdline = kaslr_get_cmdline(fdt);
>  	str = strstr(cmdline, "nokaslr");
> -	if (str == cmdline || (str > cmdline && *(str - 1) == ' '))
> +	if (str == cmdline || (str > cmdline && *(str - 1) == ' ')) {
> +		kaslr_status = KASLR_DISABLED_CMDLINE;
>  		return 0;
> +	}
>  
>  	/*
>  	 * OK, so we are proceeding with KASLR enabled. Calculate a suitable
> @@ -170,3 +184,24 @@ u64 __init kaslr_early_init(u64 dt_phys)
>  
>  	return offset;
>  }
> +
> +static int __init kaslr_init(void)
> +{
> +	switch (kaslr_status) {
> +	case KASLR_ENABLED:
> +		pr_info("KASLR enabled\n");
> +		break;
> +	case KASLR_DISABLED_CMDLINE:
> +		pr_info("KASLR disabled on command line\n");
> +		break;
> +	case KASLR_DISABLED_NO_SEED:
> +		pr_warn("KASLR disabled due to lack of seed\n");
> +		break;
> +	case KASLR_DISABLED_FDT_REMAP:
> +		pr_warn("KASLR disabled due to FDT remapping failure\n");
> +		break;
> +	}
> +
> +	return 0;
> +}
> +core_initcall(kaslr_init)
> -- 
> 2.20.1
> 

_______________________________________________
linux-arm-kernel mailing list
[email-masked]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel